March 2019 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2019:0294-1: important: Security update for hiawatha
by opensuse-security＠opensuse.org 06 Mar '19

06 Mar '19

openSUSE Security Update: Security update for hiawatha ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0294-1 Rating: important References: #1125751 Cross-References: CVE-2019-8358 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hiawatha to version 10.8.4 fixes the following issue: Security issue fixed: - CVE-2019-8358: Fixed a vulnerability which allowed a remote atacker to perform directory traversal when AllowDotFiles was enabled (bsc#1125751). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-294=1 Package List: - openSUSE Leap 15.0 (x86_64): hiawatha-10.8.4-lp150.2.4.1 hiawatha-debuginfo-10.8.4-lp150.2.4.1 hiawatha-debugsource-10.8.4-lp150.2.4.1 hiawatha-letsencrypt-10.8.4-lp150.2.4.1 References: https://www.suse.com/security/cve/CVE-2019-8358.html https://bugzilla.suse.com/1125751

1 0

openSUSE-SU-2019:0291-1: important: Security update for procps
by opensuse-security＠opensuse.org 04 Mar '19

04 Mar '19

openSUSE Security Update: Security update for procps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:0291-1 Rating: important References: #1092100 #1121753 Cross-References: CVE-2018-1122 CVE-2018-1123 CVE-2018-1124 CVE-2018-1125 CVE-2018-1126 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for procps fixes the following security issues: - CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100). - CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100). - CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100). - CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100). - CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100). (These issues were previously released for SUSE Linux Enterprise 12 SP3 and SP4.) Also the following non-security issue was fixed: - Fix CPU summary showing old data. (bsc#1121753) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-291=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libprocps3-3.3.9-23.1 libprocps3-debuginfo-3.3.9-23.1 procps-3.3.9-23.1 procps-debuginfo-3.3.9-23.1 procps-debugsource-3.3.9-23.1 procps-devel-3.3.9-23.1 References: https://www.suse.com/security/cve/CVE-2018-1122.html https://www.suse.com/security/cve/CVE-2018-1123.html https://www.suse.com/security/cve/CVE-2018-1124.html https://www.suse.com/security/cve/CVE-2018-1125.html https://www.suse.com/security/cve/CVE-2018-1126.html https://bugzilla.suse.com/1092100 https://bugzilla.suse.com/1121753

1 0

openSUSE-RU-2019:0290-1: moderate: Recommended update for vlc
by maintenance＠opensuse.org 04 Mar '19

04 Mar '19

openSUSE Recommended Update: Recommended update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0290-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for vlc fixes the following issues: - fix building with the latest libx264 with 10bit color depth support - fix a memory leak on error - fix the encoder to really drain the remaining frames This update was imported from the openSUSE:Leap:15.0:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15: zypper in -t patch openSUSE-2019-290=1 Package List: - openSUSE Backports SLE-15 (noarch): vlc-lang-3.0.2-bp150.2.3.1 - openSUSE Backports SLE-15 (x86_64): libvlc5-3.0.2-bp150.2.3.1 libvlccore9-3.0.2-bp150.2.3.1 vlc-3.0.2-bp150.2.3.1 vlc-codec-gstreamer-3.0.2-bp150.2.3.1 vlc-devel-3.0.2-bp150.2.3.1 vlc-jack-3.0.2-bp150.2.3.1 vlc-noX-3.0.2-bp150.2.3.1 vlc-qt-3.0.2-bp150.2.3.1 References:

1 0

openSUSE-RU-2019:0289-1: moderate: Recommended update for python-Sphinx
by maintenance＠opensuse.org 03 Mar '19

03 Mar '19

openSUSE Recommended Update: Recommended update for python-Sphinx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0289-1 Rating: moderate References: #1124495 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-Sphinx fixes the following issues: - also build latex subpackages on openSUSE Leap (bsc#1124495) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-289=1 Package List: - openSUSE Leap 42.3 (noarch): python-Sphinx-1.6.5-3.10.1 python-Sphinx-doc-1.6.5-3.10.1 python-Sphinx-doc-html-1.6.5-3.10.1 python-Sphinx-doc-man-1.6.5-3.10.1 python-Sphinx-doc-man-common-1.6.5-3.10.1 python-Sphinx-latex-1.6.5-3.10.1 python-sphinxcontrib-1.0.1-4.1 python-sphinxcontrib-websupport-1.0.1-4.1 python3-Sphinx-1.6.5-3.10.1 python3-Sphinx-doc-1.6.5-3.10.1 python3-Sphinx-doc-man-1.6.5-3.10.1 python3-Sphinx-latex-1.6.5-3.10.1 python3-sphinxcontrib-1.0.1-4.1 python3-sphinxcontrib-websupport-1.0.1-4.1 References: https://bugzilla.suse.com/1124495

1 0

openSUSE-RU-2019:0282-1: moderate: Recommended update for singularity
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0282-1 Rating: moderate References: #1125369 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for singularity fixes the following issues: - On openSUSE Leap 42 or SUSE Linux Enterprise 12 / PackageHub12 do not check the permissions version (boo#1125369). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2019-282=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libsingularity1-2.6.1-17.1 singularity-2.6.1-17.1 singularity-devel-2.6.1-17.1 References: https://bugzilla.suse.com/1125369

1 0

openSUSE-RU-2019:0286-1: moderate: Recommended update for yast2-smt
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for yast2-smt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0286-1 Rating: moderate References: #1106550 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-smt provides the following fix: - Make sure the module correctly starts and stops SMT again via the corresponding services. The associated checkbox was renamed to "Run ..." to better reflect the behavior. (bsc#1106550) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-286=1 Package List: - openSUSE Leap 42.3 (noarch): yast2-smt-3.0.17-2.10.1 References: https://bugzilla.suse.com/1106550

1 0

openSUSE-RU-2019:0280-1: moderate: Recommended update for libstorage-ng
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0280-1 Rating: moderate References: #1101870 #1120070 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libstorage-ng fixes the following issues: - Fix partitioning error by relaxing the check for luks correctness. (bsc#1120070, bsc#1101870) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-280=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libstorage-ng-debuginfo-3.3.317-lp150.2.15.1 libstorage-ng-debugsource-3.3.317-lp150.2.15.1 libstorage-ng-devel-3.3.317-lp150.2.15.1 libstorage-ng-integration-tests-3.3.317-lp150.2.15.1 libstorage-ng-python3-3.3.317-lp150.2.15.1 libstorage-ng-python3-debuginfo-3.3.317-lp150.2.15.1 libstorage-ng-ruby-3.3.317-lp150.2.15.1 libstorage-ng-ruby-debuginfo-3.3.317-lp150.2.15.1 libstorage-ng-utils-3.3.317-lp150.2.15.1 libstorage-ng-utils-debuginfo-3.3.317-lp150.2.15.1 libstorage-ng1-3.3.317-lp150.2.15.1 libstorage-ng1-debuginfo-3.3.317-lp150.2.15.1 - openSUSE Leap 15.0 (noarch): libstorage-ng-lang-3.3.317-lp150.2.15.1 References: https://bugzilla.suse.com/1101870 https://bugzilla.suse.com/1120070

1 0

openSUSE-RU-2019:0285-1: moderate: Recommended update for yast2-instserver
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for yast2-instserver ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0285-1 Rating: moderate References: #1122003 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-instserver provides the following fix: - Fix parsing DISTRO from 'content' file. (bsc#1122003) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2019-285=1 Package List: - openSUSE Leap 42.3 (noarch): yast2-instserver-3.1.7-4.7.1 References: https://bugzilla.suse.com/1122003

1 0

openSUSE-RU-2019:0283-1: moderate: Recommended update for tomcat
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0283-1 Rating: moderate References: #1120745 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tomcat provides the following fix: - Fix tomcat-tool-wrapper classpath error. (bsc#1120745) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-283=1 Package List: - openSUSE Leap 15.0 (noarch): tomcat-9.0.12-lp150.2.12.1 tomcat-admin-webapps-9.0.12-lp150.2.12.1 tomcat-docs-webapp-9.0.12-lp150.2.12.1 tomcat-el-3_0-api-9.0.12-lp150.2.12.1 tomcat-embed-9.0.12-lp150.2.12.1 tomcat-javadoc-9.0.12-lp150.2.12.1 tomcat-jsp-2_3-api-9.0.12-lp150.2.12.1 tomcat-jsvc-9.0.12-lp150.2.12.1 tomcat-lib-9.0.12-lp150.2.12.1 tomcat-servlet-4_0-api-9.0.12-lp150.2.12.1 tomcat-webapps-9.0.12-lp150.2.12.1 References: https://bugzilla.suse.com/1120745

1 0

openSUSE-RU-2019:0284-1: moderate: Recommended update for xkeyboard-config
by maintenance＠opensuse.org 02 Mar '19

02 Mar '19

openSUSE Recommended Update: Recommended update for xkeyboard-config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2019:0284-1 Rating: moderate References: #1123784 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xkeyboard-config fixes the following issues: - Fixes missing mappings for evdev keys KEY_RFKILL and KEY_WWAN. (bsc#1123784) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-284=1 Package List: - openSUSE Leap 15.0 (noarch): xkeyboard-config-2.23.1-lp150.2.3.1 xkeyboard-config-lang-2.23.1-lp150.2.3.1 References: https://bugzilla.suse.com/1123784

1 0